RE: IIS log - GETs vs. POSTs

[Guille -bisho- <bisho () onirica com>]

Yes. On the net all the HTTP protocol goes encripted. SSL just provides
a secure chanel for a normal HTTP request.

But in the log files the GET params of https connections are logged, so
if the server results compromised, that data is fully accesible, even
backwards.

>       That is incorrect.  Here is the transactional model:
>
> Client hello ->
> <- Server hello
> <- Server certificate
> <- serverHelloDone
> ClientKeyExchange E(Kserv, PK) ->
> ChangeCipherSpec ->
> FIN Handshake (MAC) ->
> <- ChangeCipherSpec
> <- FIN Hanshake (MAC)
> Application_data HTTP request -> (GET /?data HTTP/1.0\n\n)
> <- Application_data HTTP response (HTTP/1.1 200 OK\n...)
> Alert : close_notify ->
> <- Alert : close_notify

-- 
bisho!  _        -=] 01/09/2003 [=-
    _ ^(   )       _
   (  (   )  )     \ \___,,,
  (        )        / _____ >-
    ( :: )       >==-
  '. |::| ,  >==-
    \\:://  [ PAZ SI, GUERRA NO ]